Key Findings of the Assessment

1.1 The Department for Energy and Climate Change (DECC) is a relatively new department that has the opportunity to embed and develop its knowledge and information management practices to support key objectives.¹ Tackling energy and climate change challenges requires quality information that supports collaboration across many stakeholders. By embedding sound governance structures, policies and guidance, DECC will have the confidence that the context and record for present and future decisions is available. DECC is making steady progress against its information management goals. Already, many of the recommendations made in this report have been actioned. The Information Management Assessment (IMA) process is supporting DECC in the realisation of its Knowledge and Information Management (KIM) ambitions.

Governance and Leadership

1.2 DECC’s corporate governance structure is changing. These changes are intended to strengthen senior level accountability, visibility and the clarity of overall decision making, including that of performance and information management.

1.3 The overarching risk governance structure is not fully embedded. There is evidence of limited reporting on risk, but a more mature risk governance process for DECC will provide a fuller picture of information assurance, information technology and information management.

1.4 The roles and responsibilities of the Senior Information Risk Owner (SIRO) and the Chief Information Officer (CIO) require greater visibility, authority and influence within the department.

1.5 The core KIM team provides support for forty-two departmental Information Managers (IMs). DECC must foster recognition of the IM role so that its benefit to DECC’s KIM objectives is maximised.

¹ http://www.decc.gov.uk/en/content/cms/meeting_energy/aes/aes.aspx 1.6 In 2010, DECC completed an audit of all internal datasets not included on its Information Asset Register (IAR). This is good practice.

1.7 Understanding of the IAR and of the roles and responsibilities of Information Asset Owners (IAOs) was limited at all levels within DECC. If IAOs do not fully understand their roles they cannot provide assurance to the SIRO.

**Information and Records Management**

1.8 DECC must develop its own ‘What to Keep’ (WTK) schedules. This will provide the department with assurance that it understands how, what and where records of key policy decisions must be retained. Currently, the department relies on individual staff to make decisions on what they define as important business information, without KIM team involvement. This will affect the cohesion, clarity and consistency of DECC’s information legacy.

1.9 DECC’s records management policy and other related guidance states that information of corporate value must be stored in the Electronic Document Records Management System (EDRMS), Matrix. However, use of Matrix is not consistent in practice.

1.10 Staff use alternative document storage facilities such as personal drives, shared folders and email inboxes. Best practice supports restricting the ability to store information in such alternative systems, in favour of the corporate EDRMS, Matrix.

1.11 It is essential that private offices demonstrate good information management practice. The potential impact of missing, incomplete or unavailable information within a private office constitutes a serious risk to the reputation and effective operation of DECC. To mitigate this risk, Private Office must audit its processes annually, in order to provide assurance that its procedures are effective.

**Access to Information**

1.12 Within DECC, knowledge of how to safeguard personal information was low. DECC is at risk of failing to meet its obligations under the Data Protection Act if it does not address issues such as personal information being held by managers in Matrix without appropriate restrictions, and therefore potentially visible to all.

1.13 Although all systems used in DECC have appropriate access controls and permissions in place, these are not routinely monitored or audited at a local level. DECC faces a risk to its reputation if potentially sensitive information is not adequately safeguarded.

**Compliance**

1.14 The ‘DECC School’ training format provides a high standard in training across DECC. The inclusion of a series of lunchtime seminars for all DECC staff via ‘DECC School Light’ is seen as a way to bring the department together and share knowledge.

**Culture**

1.15 DECC’s biggest challenge is to develop a culture that values knowledge and information management and to embed knowledge sharing behaviours.

1.16 The KIM team has piloted use of SharePoint technology across some policy teams. DECC should extend this further to tackle the information retrieval and sharing issues that exist, and also to build ownership and wider participation. **Risk Matrix**

1.17 The Risk Matrix result is a culmination of the pre-assessment analysis, on-site interviews and evidence submitted.

**Governance and leadership**

| Category | Status | |---------------------------------|--------------| | Strategic management | Satisfactory | | Business objectives | Good | | Management controls | Satisfactory | | Resourcing | Satisfactory | | Risk management | Satisfactory |

**Information and records management**

| Category | Status | |-----------------------------------------|--------------| | Creation | Satisfactory | | Storage | Satisfactory | | Appraisal, disposal and transfer | Satisfactory | | Sustainability of digital records | Development Needed | | Management | Development Needed |

### Access to Information

| Category | Status | |---------------------------------|-----------------| | FOI/Data Protection | Development Needed | | Re-use | Satisfactory | | Security | Good |

### Compliance

| Category | Status | |-----------------------------------------------|-----------------| | Staff responsibilities and delegations | Satisfactory | | Policies and guidance | Good | | Training | Satisfactory | | Change management | Satisfactory |

### Culture

| Category | Status | |---------------------------------|-----------------| | Commitment | Satisfactory | | Staff understanding | Development Needed | | Knowledge management | Development Needed | | Key to Colour Coding | |------------------------------| | ![Green] | Best Practice | | ![Green and Yellow Stripes] | Good | | ![Orange] | Satisfactory | | ![Red and Yellow Stripes] | Development Needed | | ![Red] | Priority Attention Area | PART TWO: INTRODUCTION

Information Management Assessments

2.1 The Information Management Assessment (IMA) programme is the best practice model for government departments wishing to demonstrate a high level of achievement in managing their information.²

Background

2.2 The Department of Energy and Climate Change (DECC) was formed on 3 October 2008. Prior to this, climate change mitigation policy was the responsibility of the Department for Environment, Food and Rural Affairs (Defra) and energy policy was the responsibility of the Department for Business, Enterprise and Regulatory Reform (BERR).³

2.3 The 2010 Comprehensive Spending Review commits DECC to an 18 per cent real-term reduction in resource spending by 2014/15. The department's administrative budget will be reduced by 33 per cent. This will be achieved through increased use of shared services across Government, a refocusing on critical work streams and further reductions to travel, accommodation and IT expenditure.

2.4 DECC has four structural reform priorities, as outlined in its current Departmental Business Plan:

- Save energy with the ‘Green Deal’ and support vulnerable consumers;
- Deliver secure energy on the way to a low carbon energy future;
- Drive ambitious action on climate change at home and abroad;
- Manage our energy legacy responsibly and cost-effectively.

²http://www.nationalarchives.gov.uk/information-management/our-services/ima.htm

³BERR was created following the disbandment of the Department of Trade and Industry (DTI) in June 2007. Its remaining functions were transferred to the Department for Business, Innovation and Skills in June 2009. Knowledge and Information Management (KIM) in the Department of Energy and Climate Change (DECC)

2.5 The KIM team is situated within the Finance Directorate. The Head of KIM reports to the CIO. At the time of the assessment the team consisted of three permanent members of staff and one project-manager post. PART THREE: THE ASSESSMENT TEAM

3.1 The assessment was conducted by The National Archives between 9 and 13 May 2011. The assessment team comprised:

- Standards and Assessment Manager
- Head of Standards
- Standards Adviser
- Information Management Consultant
- Members of the Digital Continuity Project
- Information Management Consultant, Archive Sector Development

**Assistance provided by the Department Environment Climate and Change (DECC)**

3.2 The Assessment Team are grateful for the co-operation and assistance of all staff of DECC who were interviewed, provided additional information or facilitated the assessment process. PART FOUR: HIGHLIGHTS AND AREAS FOR IMPROVEMENT

Governance and leadership

4.1 To become an information led department, the Department of Energy and Climate Change (DECC) must have a clear understanding of how the information it collects and uses can support it in reaching its goals. To do this it must know what information it holds and where, and must be confident that the information that it is creating and collating supports and provides the context for key decisions now and in the future.

Strategic management

4.2 The department’s corporate governance structure is being remodelled. Changes to the process by which issues such as risk and performance are reported to the Board were being implemented at the time of the assessment. Once embedded, these should strengthen senior accountability and the visibility and clarity of decision making within DECC.

4.3 An Information Management Programme Board was created in 2009 to oversee the implementation of Matrix across the Department and to explore knowledge sharing across the department. In January 2011 it adopted new terms of reference to become the KIM Steering Group and took on responsibility for developing and delivering the new KIM strategy. DECC’s Head of Strategy chaired the KIM Steering Group at the time of this report.

4.4 DECC has adopted a number of shared service solutions relating to records management and technology. This arrangement has helped the department to maintain a level of business as usual since its creation. However, several managers interviewed expressed concern that the existing Service Level Agreements (SLAs) are not meeting the department’s needs as it evolves and that these decisions can affect information management.

4.5 Following the 2011 Comprehensive Spending Review, the use of shared services will assume a greater prominence across government. Business needs should be clarified and regular monitoring of contracts, updates and identification of associated risks need to be presented at a senior level in DECC. The Shared Services Integration Project Board, chaired by the director of finance, regularly reviews an issues log which captures areas of concern relating to the various shared services used by DECC. This will enable senior management to have a clear oversight and control of the SLAs to guarantee that DECC gets maximum benefit from the arrangements.

**Recommendation 1:** DECC must ensure that where key services are procured under SLAs that knowledge and information continuity risks are monitored and reported periodically to the DECC Shared Services Integration Project Board.

**Business Objectives**

4.6 DECC’s Information Management Strategy was published in 2009 with a roadmap to the end of 2010. The draft Knowledge-Sharing Strategy aims to build on this by further embedding good information management alongside the introduction of ‘knowledge sharing enablers’ and the development of a knowledge sharing culture. It contains an action plan and a knowledge sharing maturity model, an approach that has been successfully used by other government departments in the IMA programme. The new strategy has the potential to both measure and support real information management change. However, there are no clear timelines within the strategy. Once the strategy is agreed, a detailed implementation plan, including timeline, must be added to map DECC’s progress.

**Recommendation 2:** DECC to develop an implementation plan, including timeline and benefits realisation, for the Knowledge-Sharing Strategy.

4.7 DECC has successfully implemented a metric to monitor and increase use of the departmental EDRMS, Matrix, using a RAG rating system. Each month, staff are allocated a green rating if at least one document has been created within Matrix, an orange rating if at least one document has been accessed and a red rating if there has been no Matrix-related activity. The resulting statistics are reported to the SIRO and CIO and circulated monthly to Managers and IMs. The metric has given visibility to the issue of Matrix use, introduced an element of competition and correlates with an increase in the volume of information created within the EDRMS. This is a good start for DECC. However, the metric is not qualitative. DECC needs to ensure staff are not only engaging with Matrix to avoid a ‘red’ rating, but also seeking to preserve a full and accurate record of departmental activity. DECC needs to get to a stage where metrics have ongoing validity, challenge, and credibility and can support long-term KIM ambitions.

**Recommendation 3:** The KIM team should modify and review the EDRMS metrics so that they continue to challenge and raise EDRMS use.

**Resourcing**

4.8 The core DECC KIM team is led by the Head of KIM, with two full-time staff. A number of key services are also provided via a shared service provided by BIS which is managed by the head of KIM team To support the work of the KIM team there is a network of 42 Information Managers (IMs) who each support between 30 and 160 staff. IMs are expected to undertake a wide range of activities including controlling and providing access to folders in Matrix, through to raising awareness among staff of their responsibilities with regard to information management and encouraging best practice. However, there was a perception among most staff that IMs were simply Matrix administrators or “gurus” rather than a general KIM resource. DECC needs to ensure that the profile and the contribution of these roles in terms of wider KIM and records management is recognised.

**Recommendation 4:** KIM team to review how the profile of the IM role can be raised.

4.9 Awareness of the IM role and the KIM team itself was generally low. The core KIM team needs to make effective use of the IM network to support and spread the message about good information management practice. To do this, the KIM team needs to be confident that all IMs attend network meetings and are supported in doing so.

**Recommendation 5:** KIM team to assess how the expertise of the IMs can be raised to meet the department’s information needs. Risk management

4.10 DECC has a mature risk management process, with a published risk process that includes risk management meetings and audit committee. However, whilst information risk has been raised at Operations Committee, it is not yet widely understood within the business areas. Additionally, there is a lack of coordination between different roles to address the risk. A corporate risk manager responsible for the combined risks associated with information assurance, information technology, and information management would bring cohesion and aid understanding.

Recommendation 6: DECC to identify and nominate a corporate risk manager.

4.11 An improved understanding the roles and responsibilities of the Senior Information Risk Owner (SIRO) and the Chief Information Officer (CIO) should go in tandem with the wider work on governance within DECC. The Senior Information Risk Owner (SIRO) and the Chief Information Officer (CIO) are committed to KIM. However, the visibility, authority and influence of these roles was questioned by some managers. A number of interviewees were not sure of their responsibilities on how, why and to whom they should report an information assurance or information security matter if it arose.

4.12 DECC faces a reputational risk if it does not fully understand and manage the risks arising from the information it holds. This is particularly true for a department that handles information on sensitive and potentially emotive topics such as climate change and the nuclear programme. It is vital that the SIRO and CIO roles achieve greater visibility and authority.

Recommendation 7: Executive Board to communicate the importance of the SIRO and CIO roles in supporting and reporting on the department’s compliance on information security and assurance.

4.13 The emphasis of the DECC Information Asset Register is on assets that contain personal information. DECC has the opportunity to expand this to create a management tool to support them to manage their information. DECC has recently conducted an audit that identified a total of 120 datasets with business value to the department, nearly double the number of information assets currently identified on the IAR. The IAR makes provision for recording ownership and business purpose of information assets, but does not record information relating to risk, sensitivity (beyond specifying personal protect) or technical dependencies. The work done to develop the IAR should now be built upon to include all information assets of value to the department, and to capture data required to manage those assets effectively. Without these details DECC will not be in a position to identify and fully mitigate information risk, including the ability to manage its digital continuity.(^4)

**Recommendation 8:** DECC should use The National Archives’ digital continuity guidance to expand its Information Asset Register to create a management tool to support the management of information over time and through change.

4.14 The Information Asset Owner (IAO) role was found to have a low profile within the department. At the time of assessment many IAOs had not been made aware of their full responsibilities. A programme of training is needed to ensure all IAOs understand the value of their assets together with associated risks. Without this they will be unable to report effectively to the SIRO.

**Recommendation 9:** DECC should put in place a programme to train the IAOs and raise awareness of the role and its responsibilities.

4.15 DECC needs assurance that information assets which should be represented in business continuity planning are identified and that ownership is assigned and managed. In a department that is at a mature stage of risk management with respect to its information, IAR entries are used to support business continuity planning processes and procedures. This is particularly relevant for DECC, which has several shared-services and contracts in place from IT through to facilities and services management.

**Recommendation 10:** Information related to business critical assets within the IAR must be tied into departmental business continuity planning.

(^4) Digital Continuity is the ability to use information in the way that you need, for as long as you need. Guidance on digital continuity and on the construction of IARs can be found at: [http://www.nationalarchives.gov.uk/information-management/our-services/digital-continuity-stage-2.htm](http://www.nationalarchives.gov.uk/information-management/our-services/digital-continuity-stage-2.htm) Information and records management

‘What to Keep’/creation

5.1 DECC, as yet, has not defined its own ‘What to Keep’ (WTK) schedules. Although there is central guidance available on the intranet, members of staff interviewed were found to be making local decisions on what they judged to be important business information. DECC needs to maintain a full record of key policy decisions, as at present DECC lacks assurance that this is being captured. Corporate ownership of a WTK schedule tailored to the department’s own needs and objectives would provide clarity on what information needs to be kept. This would help to ensure that DECC’s legacy remains available and that obsolete information is disposed of in a structured manner.

Recommendation 11: DECC should use The National Archives guidance to develop a ‘What to Keep’ schedule for the department.

Storage

5.2 Following the merger, BIS staff continued to work on existing system, which was rolled out to ex-Defra staff. Some of this came across as read-only shared drives. At the time DECC was created, a review was carried out of information on the shared drives. Significant records were migrated onto Matrix. However, much information remains in personal drives. One interviewee stated that they had emails and other information going back ten years, which they kept ‘just in case.’ The use of the DROID tool, which has been implemented by a number of government departments, would allow DECC to identify duplicate files and the date of last revision.5

Recommendation 12: DECC to conduct a review of information held on personal drives and consider introducing a size limit.

5 The latest version of the DROID tool can be downloaded from: http://www.nationalarchives.gov.uk/information-management/our-services/dc-file-profiling-tool.htm 5.3 DECC’s record management policy states that information of corporate value must be saved into Matrix. However, use of the EDRMS was not consistent across the department. Staff were generally confident in its use and understood its purpose as a corporate repository. This was despite complaints about occasional technical problems such as documents corrupting and comments that it was ‘clunky’ and that information was difficult to find once filed. Others were reluctant to use Matrix, only used it for key final documents or barely accessed it except to comply with the monthly monitoring. If staff does not understand what should be saved to Matrix and do not use the EDRMS consistently there is a risk that context, such as key facts on which advice is based, will be lost.

5.4 Staff also file information in Outlook folders and personal or shared drives. The multiple choices available to staff lead to duplication, difficulty in locating documents and inconsistencies in what is saved and how it is saved. Best practice dictates a clear mandate to use an existing system, whether it is an EDRMS, SharePoint or approved shared drives. At the same time the ability to save information elsewhere should be restricted, and a solid record and information management culture awareness programme put in place to ensure that corporate or key business information is stored appropriately.

5.5 The assessment team found little evidence that DECC’s guidance on naming documents and folders is enforced. Poor naming of documents impacts on the ability of staff to receive good results from searches carried out in their own areas and across the file plan. Good naming practice should be encouraged at a local level to ensure that important information can be discovered and understood outside of the immediate business area.

Recommendation 13: DECC should ensure that IMs are empowered to challenge staff over poor naming of documents and encourage colleagues to follow departmental guidance.

Recommendation 14: DECC should mandate usage of the EDRMS and impose limits on exceptions to the policy and communicate to all.

5.6 Matrix will be unsupported from 2014, DECC has a project due to start in autumn 2011 to assess future options for records and information management. Relevant Digital Continuity guidance available from The National Archives may be of help to DECC when planning future technology. However, until a solution has been decided DECC must minimise the risk that business information cannot be found or accessed.

5.7 A pilot was being run to establish how well SharePoint 2007 can be used as a knowledge sharing enabler, an interface with Matrix, and to host the Intranet. It is hoped that this will provide a viable search capability for both. This may be good for the department if this creates an environment for structured record and information management control.

File Plan

5.8 The Matrix file plan is limited to four levels. New folders need approval from IMs who can also rename and hide, rather than delete, folders. Whilst the flat structure of the file plan might cause some inconvenience for a minority of DECC staff, it provides structure, discipline and consistency.

5.9 Technical infrastructure is provided by Fujitsu but the EDRMS service is contracted through BIS. DECC uses a section of the BIS record plan in Matrix. This was designed by DECC, but as the shared service is provided ‘as is’, DECC is constrained to record plan rules applied by BIS. Discussions are ongoing with BIS to ensure that the current SLA fully reflects the changing needs of DECC. BIS oversee management and development of Matrix, including any requests to amend or add to the file plan. This arrangement has placed limits on what DECC can do to change the record plan.

Paper files

5.10 BIS is contracted under the records management SLA to register and manage DECC’s paper files, and DECC state that this is working satisfactorily. Plans are underway to move paper files from the current repository in Earlsfield, London, to Cardiff by 2012, which will require large volumes of paper files to be rapidly

______________________________________________________________________

6 The Digital Continuity framework contains specific information about solutions and services. Details can be found at: [http://www.nationalarchives.gov.uk/information-management/our-services/dc-technical-tools.htm](http://www.nationalarchives.gov.uk/information-management/our-services/dc-technical-tools.htm) reviewed. These paper records will be appraised in accordance with the BIS criteria.

**Recommendation 15: The KIM team to develop appraisal criteria for legacy records.**

5.11 BIS and DECC’s paper legacy files are stored together but no audit has been carried out to establish the relative volumes that are held. Work is being undertaken to define DECC and BIS responsibilities over the registered paper records.

5.12 There is an assumption within DECC that the department is a digitally based department. While the creation of paper records is very limited, staff do, in some cases, have an ongoing duty to collate, register and store specific important information that may be in paper form; for example, nuclear plant planning decisions. In addition, the IMA team found evidence that staff were keeping paper copies of potentially sensitive information so that it would be ‘close at hand.’ This puts the department at risk of failing to meet its obligations under the Data Protection Act.

**Recommendation 16: The KIM team needs to ensure that KIM guidance references all record types, including legacy paper records.**

**Private Office**

5.13 DECC private offices follow Model 2 of The National Archives’ guidance in the management of its records. This places the onus on policy areas to ensure that records are captured within the departmental records system. Private Office will only accept submissions that are emailed in the form of Matrix links, which ensures these key documents, are captured within the EDRMS. **This is good practice.**

______________________________________________________________________

7 Guidance on records management within Private Office can be found on the Information Principles resource pages at: [http://www.nationalarchives.gov.uk/documents/information-management/paperguidance2009.pdf](http://www.nationalarchives.gov.uk/documents/information-management/paperguidance2009.pdf) 5.14 However, the assessment team found some confusion over the procedures and responsibilities for recording Private Office generated information. The team also found evidence that duplicate copies and information available in alternative formats was being retained without a clearly defined purpose. The Private Office is a key information hub and the potential impact of missing, incomplete or unavailable information poses a serious reputational risk to DECC. The private offices need to lead by example, with the assurance that key information is available, that Private Office staff are adhering to procedures and that their offices are managing their decisions and information efficiently.

Recommendation 17: The KIM Team to liaise with the private offices in the implementation of an annual audit as referenced within The National Archives’ guidance to ensure that they are operating effectively.

Emails

5.15 Emails within DECC are automatically deleted from Outlook after a year. DECC guidance advises staff what type of email should be saved to Matrix and when. A minority followed this guidance. There was little other evidence of proactive email management. One interviewee admitted to having “seven thousand” emails archived and others admitted that important information had been lost through automatic deletion. Poor management of emails contributes to the risk that important legacy information will to be lost or become inaccessible.

Recommendation 18: The KIM Team and ICT should audit email inboxes to provide the base to identify and mitigate the risk of poor email management.

Appraisal and disposal

5.16 Digital Information is held in several locations, from personal drives to the EDRMS and shared drives. This makes understanding what is available, its age, and choices regarding timely review and disposal problematic. The monthly Matrix RAG ratings and Private Office’s insistence on the use of links instead of attachments both help underline the importance of the EDRMS. Using WTK schedules and a clear retention policy will underpin this. Digital continuity

5.17 The findability of DECC’s information is poor, largely because it is held in a number of different systems and locations. Matrix is regarded as a repository for filing away final documents, not as a tool for managing, finding or sharing them. Staff do not consider future findability when naming files or creating metadata – although there was agreement that finding information in Matrix is much easier if it has been named in a meaningful way.

5.18 DECC does not yet have a strategy for management of digital continuity and there is a lack of clarity on how key internal roles, business units and external service providers should work together to ensure that DECC’s digital information remains usable over time. The KIM, IT and IA need to work closely to support management of digital continuity and enable relevant risks to be raised and managed. A Senior Responsible Owner should be appointed to lead in this area.

Recommendation 19: DECC to develop a strategy for managing digital information drawing on expertise from all relevant teams within the department.

5.19 DECC’s sensitive information assets are captured on the departmental IAR, in line with the recommendations of the DHR. However, the department does not yet have a comprehensive understanding of the range of information it holds, its value or the associated risks. Populating and maintaining the IAR will rely on DECC appointing IAOs at the right level, with a clear understanding of the business value of their information assets, and with adequate support from IT. This work will deliver the additional benefit of supporting the identification and managed disposal of information that has no clear business purpose, delivering efficiencies and reducing risk.

5.20 DECC needs to improve the management of its information assets and to continue to work on their identification, to include all information of value to the department. DECC should use its Information Asset Register to record the value, business use, location(s), format and risk of each individual information asset, in addition to ownership, content and sensitivity. DECC should also review information that is not managed as an asset and dispose of it where appropriate. 5.21 DECC holds information in both legacy and proprietary systems, which are particularly vulnerable to loss of continuity. DECC should apply its understanding of the technical dependencies of its information assets, as documented in the IAR, to maintain the usability of its information assets over time and through technical change. This will support DECC in improving the alignment between the department’s requirements for using its information, and the technology that supports it.

**Recommendation 20:** DECC to embed digital continuity into the IT change management process, with a digital continuity impact assessment as a core component.

5.22 DECC’s IT and records management services are supplied by BIS. This is a streamlined approach to procurement, which has delivered good continuity of service for staff transferred from BIS. However, the technology roadmap for Matrix is driven by BIS requirements. DECC needs to ensure that its needs are fully met and that it has influence over the technical environment.

**Recommendation 21:** DECC to develop a technology roadmap for Matrix continuing to engage suppliers and pilot new approaches to identify options.

**Recommendation 22:** DECC to include digital continuity requirements in the specification and procurement of new systems to cover interoperability, data exchange and extraction and standardised technology. Access to Information

Data Protection Act

6.1 Knowledge of the means by which sensitive personal information can be safeguarded, and the controls available, was found to be low. Staff in HR understood this need, but noted that the move to a shared service for HR had increased certain challenges as personal information was held on at least three systems with the physical HR files elsewhere.

6.2 In other areas, it was less clear that the principles of the Data Protection Act were understood or being followed. Examples were cited of applicant’s CV’s, contracts and other personal information being held by managers in Matrix without appropriate restrictions which meant they were potentially visible to all users. This situation should be rectified, as DECC is at risk of failing to meet its obligations under the Data Protection Act.

Recommendation 23: DECC to review how data protection training is cascaded and implemented to ensure personal information is held and managed effectively.

Freedom of Information Act (FOIA)

6.3 Freedom of Information queries are managed under the BIS SLA. Most recently published figures at the time of the IMA show DECC answered 89 per cent of request within time (Jan-Mar 2011). Queries are pursued by action officers in DECC and overseen by an appointed BIS case officer. Action officers are also responsible for carrying out redaction in line with BIS guidance. No monitoring has been carried out to see how effectively this is being done.

6.4 The decision to release or withhold material lies with DECC. The department

8 FOI statistics for DECC and other government departments can be found on the Ministry of Justice website at: http://www.justice.gov.uk/statistics/foi/implementation needs to assume ownership of the process as handling FOI queries and understanding of the importance of FOIA were found to vary. To do this DECC must support a general information awareness and training programme for key internal staff. To obtain buy-in from staff clear responsibilities should be defined and communicated. DECC must assure itself that guidance is understood and that proper procedures are being followed. Until such time as the SLA is up for review, working with BIS for improved training of DECC staff on FoI could provide consistency and raise standards and awareness.

**Recommendation 24: DECC should work within the BIS SLA to refresh the FOI training and communication programme for staff.**

**Re-use**

6.5 At the time of assessment DECC had published a total of 37 datasets on data.gov.uk. DECC offers data via its website with statistics and analysis available to download under key headings including energy, fuel poverty and climate change. The oldest of these, a graph of average annual surface temperatures, dates back to the eighteenth century. The DECC Business Plan recognises that improving transparency can play an important part in helping the department to achieve its objectives. It states that the department is complying with the Prime Minister’s commitments on transparency, and seeks to go further in its commitments where possible. The recent audit of databases conducted within DECC has enabled the department to assess what is currently published and assess what further material could be made available including in redacted form.

**Security**

Most staff understood information assurance and information security in relation to the move to flexible working arrangements, being responsible for safeguarding their laptops and being careful about sharing information outside the department. Access to laptops is strictly controlled, with each one reflecting the working requirements of the individual. All information written to removable media is encrypted.

6.6 There was a misconception among some staff that access to information in Matrix did not need to be controlled as it was an internal system accessible only to colleagues. Audits of access permissions to DECC systems, such as Matrix were not in evidence, although a minority of IMs proactively reviewed local access permissions. A failure to consistently review and control access permissions increases the risk that sensitive information will not be adequately protected, a risk that is increased when placed in context with out-of-date staff directories, ad-hoc use of corporate systems and use of removable media.

**Recommendation 25: KIM team to develop access control auditing processes** Compliance

Staff responsibilities and delegations

6.7 The IM network has a key role to play in enabling DECC’s goal of transforming into an effective organisation that shares its knowledge. The KIM team has worked hard to update guidance and identify IMs and some IMs are now proactively working to raise the standard of information management. Raising the standard of KIM across DECC will require the ongoing, visible commitment of senior management. The KIM team should take the lead by communicating with and managing the IM network to ensure the provision of local information and record management support.

Policies and guidance

6.8 KIM guidance is accessible via a prominent link on the front page of the department’s Intranet. The KIM team are in the process of updating the records and information management guidance to support the draft Knowledge Sharing Strategy. However, although much existing guidance was found to be clear, compliance to KIM guidance was found to be variable. Examples were cited of staff unsure of the minimum financial and project records that needed to be kept. Other interviewees requested clarity on what constitutes a record. All the above should figure prominently in the refreshed guidance and WTK schedules to enable DECC to be effective in how it uses its information.

Recommendation 26: The KIM team to mandate the minimum record standards to be kept and incorporate them into WTK and KIM guidance.

6.9 Across DECC there was evidence that teams had their own ways of working, among which were some examples of good record and IM practice. One IM in Finance produced comprehensive local Matrix user notes; these were well received and also correlated with high levels of EDRMS use.

Government Protective Marking Scheme

6.10 Use of protective marking was found to be inconsistent. Staff responses to the question of if, how and when they used protective marking ranged from the conscientious user, to no understanding of protective marking, or only using marking on external communications. The proper application of protective marking ensures that sensitive information can be protected and non-sensitive information can be shared with confidence.

Recommendation 27: DECC should explore what initiatives are available or in use by government departments to raise awareness and use of protective marking.

The intranet

6.11 The intranet contains some direct links to BIS or Defra content, rather than DECC-specific guidance. The department has now been in existence for over two years; information on the departmental intranet should be branded as a DECC resource where it does not relate to shared services.

Recommendation 28: DECC should review, delete and rebrand BIS or Defra’s intranet content.

6.12 Policy references were also not linked to teams nor located in one area. An online policy library would make finding information easier for users. Staff reported the regular use of external search engines to find DECC policies.

6.13 Contact information on teams and the staff directory were found to be outdated, making finding the right information problematic. This was a problem for those staff who relied on informal networks or contacts to find information.

Training

6.14 The creation of DECC School and DECC School Lite, the comprehensive training programme for all DECC staff, has the potential to set high standards for training within DECC. Positive reactions were received from staff who say the seminars are a means to get to know each other and an opportunity for the department to integrate. This is to be commended.

6.15 Induction training covers knowledge and information management practice including information assurance. Online training is pushed to all staff on data protection. Staff have limited, read-only access to Matrix until they have attended Matrix training, which is conducted off site by BIS under the SLA. It is primarily about use of the EDRMS, or ‘buttonology’, without reference to DECC IM procedures. A quality assessment of the training, which would ensure the training is fit for purpose, has not been carried out. The training should be reviewed as part of the SLA review.

6.16 Occasionally, there is a time lag between staff joining DECC, receiving training on Matrix and obtaining access to the live system. In the meantime, staff are able to store information in personal and shared drives, repositories that remain available when full Matrix access is given. DECC should ensure that managers understand the importance of requesting prompt training so that staff do not get the chance to develop bad records and information management habits.

Recommendation 29: DECC should assess how induction training can be improved within available resources to meet departmental needs.

Recommendation 30: The KIM team to input into the BIS Matrix training as part of the SLA review. Culture

7.1 Good information management practices were not consistently applied across DECC. DECC is a new department with an emerging culture. Embedding sound information management practice will be crucial in helping DECC achieve business objectives. Flexible working and ‘hot desking’ are the norm, which add an additional challenge to ensuring consistency and embedding good information management practice. Embedding changes to the governance structure and setting common standards for managing information will enhance good information management. DECC should also aim to make the best use of both the expertise and the information available.

Commitment

7.2 Commitment to knowledge and information management within DECC is developing, with evidence of mature information management structures within some individual teams, such as Nuclear Planning and consents. DECC needs to ensure staff are clear how both the department and the individual will benefit from good information management practice. Developing a DECC centric ‘What to Keep’ policy and defining its core business information will give the department a good base on which to build.

Information Sharing

7.3 The historic differences between the climate change and energy parts of the business are recognised by senior management. These differences have created a barrier to information sharing that is being overcome. Individuals within DECC had made efforts to establish their own networks; these were often based on a need to work on a common policy or project task.

7.4 The concept of ‘newness’ also had an impact on how staff searched, reviewed or referenced previous information. Several interviewees stated that they would not look for information in DECC systems that was over two years old as they would not be able to find it or trust its integrity, and would instead either commission new research, produce their own or find the person associated with that policy and seek information that way. DECC aims to become a knowledge sharing department. In a time of efficiency savings any potential to duplicate work and tie up limited resources should be avoided.

**Knowledge management/transfer**

7.5 Staff at all levels perceived that DECC operates in functional silos, in part because of the mergers that formed the department. The existence of specialist teams, and teams with clear local objectives that need to be delivered irrespective of departmental priorities, may also play a part. The existence of these silos has created a working environment where knowledge is overly invested in its people rather than formal structures and processes. When knowledge sharing takes place, informal channels dominate. The risk that key knowledge will not be shared or be lost will be magnified if the majority of the department operates in this way.

7.6 The role guidance for IMs contains a requirement to ensure that the records of temporary staff, and staff leaving teams, are captured. This is an important safeguard to have in place until DECC reaches a point where records and information guidance is universally adhered to and key information is saved to Matrix as a matter of course. The Assessment Team are aware of plans to pilot a knowledge capture process for departmental fast streamers, but no formal knowledge capture process has been developed for staff who move and change roles.

**Recommendation 31:** DECC should develop and implement a formal knowledge capture process to include access to that information once recorded. APPENDIX ONE: SUMMARY OF RECOMMENDED ACTIONS

8.1 This is a summary of the recommended actions to remedy the weaknesses identified and strengthen the commitment to the Information Management Assessment Programme. These recommendations, when agreed, will form an action plan that will be monitored by The National Archives.

| Business Area | Recommendation | |---------------|----------------| | Governance and Leadership | 1 DECC must ensure that where key services are procured under SLAs that knowledge and information continuity risks are monitored and reported periodically to the DECC Shared Services Integration Project Board. This may be achieved by:

- Defining a set of metrics for contract monitoring.
- Agreeing a timetable for reporting. | | | 2 DECC to develop an implementation plan, including timeline and benefits realisation, for the Knowledge-Sharing Strategy. This may be achieved by:
- A detailed project plan with agreed milestones.
- Regular updates to a relevant change programme or project board. | | | 3 The KIM team should modify and review the EDRMS metrics so that they continue to challenge and raise EDRMS use. This may be achieved by:
- Including the number of documents into the EDRMS, when updated, number of emails filed, etc. | | | 4 KIM team to review how the profile of the IM role can be raised. This may be achieved by:
- Reviewing training requirements for the role.
- A community of practice section on the Intranet.
- Restating the importance of the role to managers. | | | 5 KIM team to assess how the expertise of the IMs can be raised to meet the department’s information needs.
- See recommendation 4 above. | | | | |---|---| | **6** | **DECC to identify and nominate a corporate risk manager.** This may be achieved by:
- Referring to Managing Information Risk: A guide for Accounting Officers, Board Members and Senior Information Risk Owners.
- Referring to the Digital Continuity guidance on the management of digital continuity risk. | | **7** | **Executive Board to communicate the importance of the SIRO and CIO roles in supporting and reporting on the department's compliance on information security and assurance.** This may be achieved by:
- Reviewing and strengthening the reporting structures to the SIRO and CIO.
- Communicating the responsibilities to all managers for information security and assurance.
- Accessing support available from the Cabinet Office for the SIRO and CIO guidance. | | **8** | **DECC should use The National Archives’ digital continuity guidance to expand its Information Asset Register to create a management tool to support the management of information over time and through change.** This may be achieved by:
- Referring to the digital continuity guidance to support on The National Archives’ website. | | **9** | **DECC should put in place a programme to train the IAOs and raise awareness of the role and its responsibilities.** This may be achieved by:
- Using the digital continuity guidance as a basis for the training.
- Reviewing how the IAO role has been assigned within DECC. |

______________________________________________________________________

9 [http://www.nationalarchives.gov.uk/services/publications/information-risk.pdf](http://www.nationalarchives.gov.uk/services/publications/information-risk.pdf)

10 Digital continuity is the ability to use information in the way that you need, for as long as you need. Digital continuity guidance includes role specific guidance and details of how to conduct a digital continuity risk assessment. [http://www.nationalarchives.gov.uk/information-management/our-services/digital-continuity.htm](http://www.nationalarchives.gov.uk/information-management/our-services/digital-continuity.htm) | | Records and Information management | |---|-----------------------------------| | 10 | Information related to business critical assets within the IAR must be tied into departmental business continuity planning. This may be achieved by:

- Referring to the digital continuity guidance. | | 11 | DECC should use The National Archives guidance to develop a ‘What to Keep' schedule for the department. This may be achieved by:
- Utilising the available professional support and guidance to assess best practice and use examples from other government departments. | | 12 | DECC to conduct a review of information held on personal drives and consider introducing a size limit. This may be achieved by:
- Linking the information from the IAR, information on ICT systems.
- Using the knowledge of the in house IT staff, contractors, IMs, IARs and managers to collate this information. | | 13 | DECC should ensure that IMs are empowered to challenge staff over poor naming of documents and encourage colleagues to follow departmental guidance. This may be achieved by:
- See recommendation 4 above. | | 14 | DECC should mandate usage of the EDRMS and impose limits on exceptions to the policy and communicate to all. This would be supported by:
- Limiting personal drive sizes.
- Reviewing the provision of shared drives to business units.
- Using IMs and middle managers to drive compliance. | | 15 | The KIM team to develop appraisal criteria for legacy records. This may be achieved by:
- See recommendation 11 above. | | 16 | The KIM team needs to ensure that KIM guidance references all record types, including legacy paper records. This may be achieved by:
- Updating current records and information guidance. | | 17 | The KIM Team to liaise with the private offices in the implementation of an annual audit as referenced within The National Archives’ guidance to ensure that they are operating effectively. This may be achieved by:
- Referring to Guidance on the Management of Private Office Papers.(^\\text{11}) | | 18 | The KIM Team and ICT should audit email inboxes to provide the base to identify and mitigate the risk of poor email management. This may be achieved by:
- Use of available metrics available on use of the EDRMS and that provided by IT. | | 19 | DECC to develop a strategy for managing digital information drawing on expertise from all relevant teams within the department. This may be achieved by:
- See recommendation 8 above. | | 20 | DECC to embed digital continuity into the IT change management process, with a digital continuity impact assessment as a core component. This may be achieved by:
- See recommendation 8 above. | | 21 | DECC to develop a technology roadmap for Matrix continuing to engage suppliers and pilot new approaches to identify options. This may be achieved by:
- See recommendation 8 above. | | 22 | DECC to include digital continuity requirements in the specification and procurement of new systems to cover interoperability, data exchange and extraction and standardised technology. This may be achieved by:
- See Recommendation 8 above. |

(^{11}) Guidance on records management within Private Office can be found on the Information Principles resource pages at: [http://www.nationalarchives.gov.uk/documents/information-management/popapersguidance2009.pdf](http://www.nationalarchives.gov.uk/documents/information-management/popapersguidance2009.pdf) | | | | |---|---|---| | **Access** | | | | 23 | **DECC to review how data protection training is cascaded and implemented to ensure personal information is held and managed effectively.** This may be achieved by:

- Reviewing the attendance of courses | | | 24 | **DECC should work within the BIS SLA to refresh the FOI training and communication programme for staff.** | | | 25 | **KIM team to develop access control auditing processes.** | | | **Compliance** | | | | 26 | **The KIM team to mandate the minimum record standards to be kept and incorporate them into WTK and KIM guidance.** This may be achieved by:
- See recommendation 11 above. | | | 27 | **DECC should explore what initiatives are available or in use by government departments to raise awareness and use of protective marking.** | | | 28 | **DECC should review, delete and rebrand BIS or Defra’s intranet content.** This may be achieved by:
- Incorporation into the ongoing refresh of record and information management guidance, and the review of ongoing review of EDRMS training. | | | 29 | **DECC should assess how induction training can be improved within available resources to meet departmental needs.** | | | **Culture** | | | | 30 | **The KIM team to input into the BIS Matrix training as part of the SLA review.** This may be achieved by:
- Agreeing content to cover DECC’s WTK guidance and records and information management. | | | 31 | **DECC should develop and implement a formal knowledge capture process to include access to that information once recorded.** This may be achieved by:
- Creating a template that includes set questions.
- Ensuring that staff and managers know when and who must complete it. | |

## APPENDIX THREE: GLOSSARY

| Acronym | Description | |---------|-------------| | BIS | Department for Business, Innovation and Skills | | CIO | Chief Information Officer | | DECC | Department of Energy and Climate Change | | Defra | Department for Farming and Rural Affairs | | DHR | Data Handling Review | | EDRMS | Electronic Records Management System | | FOI | Freedom of Information | | FOIA | Freedom of Information Act | | IA | Information Assurance | | IAO | Information Asset Register | | IAR | Information Asset Owner | | IM | Information Manager | | IMA | Information Management Assessment | | KIM | Knowledge and Information Management | | SIRO | Senior Information Risk Owner | | SLA | Service Level Agreement | | WTK | What to Keep |